Dozens of universities in the blast zone after hackers exploit QuickLaunch

Attackers have exploited a couple of known QuickLaunch vulnerabilities, which allowed them to create user accounts and steal private information. At least 42 universities were identified as potential targets, and 40 more were listed as using another type of sign-on setup.

Despite relying on cybercrime to survive, hackers are not immune to blunders. For example, the Cybernews research team recently discovered an exposed hacker server that revealed how they carried out a global supply-chain attack.

According to our researchers, attackers targeted numerous universities worldwide, attempting to access their login systems and force their way through to students’ and teachers’ personal data.

Records discovered on the attackers’ server suggest that the cybercriminals stole account details, email addresses, internal system information, and some mailbox contents.

The team claims that the most damage was done by exploiting QuickLaunch, an AI-powered tool that helps colleges and universities manage how students and staff sign in to school systems and access online services.

We’ve also reached out to the company for a statement and will update this article once we receive a reply.

How does the login attack work?

The data the team discovered on the exposed server indicates that the attacker appears to have chained together several weaknesses in QuickLaunch and the underlying WSO2 identity software to move from initial access to deeper compromise.

The WSO2 identity server is an Identity and Access Management (IAM) platform. It helps organizations manage access to applications, APIs, and services through centralized authentication, authorization, and user management.

According to the exposed records, CVE-2024-7097 allowed cybercriminals to create unauthorized user accounts via the QuickLaunch API, giving them a foothold in the environment.

Meanwhile, CVE-2025-5605 exposed internal system information, including memory statistics, which could help the attackers understand and map the target system.

The records also point to a QuickLaunch-specific password-reset weakness, which let the attackers take over at least one real university account if security questions had never been enrolled.

Moreover, the attacker appears to have exploited an undocumented issue in WSO2’s WS-Federation Passive STS service to obtain a valid login token even with the wrong password.

WSO2 login services verify a user's identity and return an access token so other applications know the user is already signed in. The token that the attackers obtained was then used as proof of authentication, allowing them to access internal user data and, in at least one case, mailbox contents.

What other information was on the attackers’ server?

The exposed server contained more information than just attack notes. For one, researchers found 373 Python scripts believed to have supported the operation, along with 43 Markdown files outlining attack paths and reporting on results.

Interestingly, some of those reports were written in Mandarin Chinese and styled like legitimate red-team assessments, suggesting the operator may have been Chinese-speaking. However, based on that alone, we cannot clearly identify the attacker as being based in China.

However, the server also contained numerous JSON, CSV, and text files with interim and final results, plus 2 environment files exposing a DeepSeek API key, indicating that some parts of the workflow may have been automated with Chinese-made AI assistance.

A public SSH key, likely tied to the attacker, was also left behind. The server stored a large dataset linked to QuickLaunch environments, including roughly 32,400 unique user records across 1,079 domains, with names, email addresses, and user IDs.

The attackers also targeted 40 universities using self-hosted ADFS, another campus login system. Records show 36 instances of exposed federation metadata, including technical details such as endpoints and certificates. While that did not prove a breach on its own, it provided the attackers with useful intelligence to map systems and plan follow-on attacks.

Why is this important?

Specific industries are more likely to use particular B2B solutions to manage their operations, which means that those who develop these tools have a responsibility to ensure the security of their client data.

“If the product is misconfigured, if edge cases are not thought through, and if the tools are not regularly updated, it increases the potential attack surface significantly,” our researchers explained.

In this specific case, the affected education institutions face risks beyond just account compromise.

“They handle large amounts of personal and financial data of students and staff, which can be used for identity theft, financial fraud, and social engineering attempts. More often than not, universities are in possession of sensitive, unpublished research and intellectual property,” the researchers added.

Our team also noted that since the attack points to China, other goals may have been involved. For example, Chinese threat actors often target educational institutions to obtain data about sensitive research projects and steal IP for local reproduction.

The team noted that as of September 2nd, the threat actors appear to have closed the server.

Disclosure timeline:

• Exposed threat actor served discovered: July 17th, 2026
• Initial disclosure to QuickLaunch: August 5th, 2026
• Threat actor sever observed closed: September 2nd, 2026